feat(contracts): contrato de aplicación y cláusulas verificables

.github/ISSUE_TEMPLATE/clause.yml

@@ -0,0 +1,59 @@
+name: Clause
+description: Cláusula del contrato de aplicación (ADR-0011)
+title: "[Clause] "
+labels: ["kind:clause"]
+body:
+  - type: input
+    id: clause_id
+    attributes:
+      label: Id de cláusula
+      description: Identificador cerrado CLAUSE-*-001.
+      placeholder: CLAUSE-BASE-001
+    validations:
+      required: true
+  - type: input
+    id: schema_path
+    attributes:
+      label: Ruta del schema
+      description: Norma JSON Schema Draft 2020-12 de esta cláusula.
+      placeholder: contracts/json-schema/clause-base.schema.json
+    validations:
+      required: true
+  - type: input
+    id: test_name
+    attributes:
+      label: Nombre del test
+      description: Función de test Rust de cumplimiento estricto.
+      placeholder: clause_base_001_accepts_valid_and_rejects_invalid
+    validations:
+      required: true
+  - type: dropdown
+    id: formats
+    attributes:
+      label: Formatos afectados
+      description: Targets DEC-001 sobre los que aplica la cláusula.
+      multiple: true
+      options:
+        - archmaker-profile
+        - archinstall-profile
+        - report
+    validations:
+      required: true
+  - type: dropdown
+    id: compliance
+    attributes:
+      label: Estado de cumplimiento
+      options:
+        - pending
+        - red
+        - verified
+      default: 0
+    validations:
+      required: true
+  - type: textarea
+    id: notes
+    attributes:
+      label: Notas
+      description: Evidencia de rojo/verde, issues bloqueantes o exclusiones.
+    validations:
+      required: false

.github/workflows/json-schema.yml

@@ -113,6 +113,14 @@ jobs:
               "artifact",
               "installation-plan",
               "runner-envelope",
+              "application-contract",
+              "clause-base",
+              "clause-manifest",
+              "clause-option",
+              "clause-rule",
+              "clause-bytes",
+              "clause-host",
+              "clause-boot",
           ]
 
           # Casos que se validan contra un subschema de common o un $defs concreto.

contracts/json-schema/CHANGELOG.md

@@ -21,6 +21,20 @@ declaran `schemaVersion: "1"`; la etiqueta `v0` es la revisión del contrato, no
 `schemaVersion`). Cambiar la forma de un contrato exige incrementar `schemaVersion` y una
 _migration note_ (`docs/03-data/versioning-migrations.md`).
 
+## v0.2 — Contrato de aplicación (ADR-0011)
+
+### Añadidos
+
+- `application-contract.schema.json`: contrato generado desde la selección resuelta, base
+  Arch Linux x86_64 y formato DEC-001.
+- `clause-base.schema.json` … `clause-boot.schema.json`: siete cláusulas con `$id` propio.
+- Corpus `24-application-contract.*` y `25-clause-base.*` … `31-clause-boot.*`.
+
+### Notas
+
+- No se amplía el enum de targets de `artifact.schema.json` (DEC-001 intacto).
+- `CLAUSE-BOOT-001` no admite `status: satisfied` mientras el formato de imagen esté cerrado.
+
 ## v0.1 — MVP-1 (domain / catalog / migration)
 
 ### Modificados

contracts/json-schema/README.md

@@ -26,19 +26,27 @@ tipado v1 y nunca un script.
 `$ref` es **por `$id`**, no por ruta de fichero (registro de `$id` en el gate). Los `$defs`
 compartidos viven una sola vez en `common.schema.json`.
 
-| Archivo                         | Agregado                  | Ejes de versión                                                                                   | Estado       |
-| ------------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------- | ------------ |
-| `common.schema.json`            | `$defs` compartidos       | —                                                                                                 | v0           |
-| `draft.schema.json`             | DM-DRAFT                  | `documentVersion`, `schemaVersion`, `revision`, `catalogRef.version`, `targetRef.version`         | v0           |
-| `catalog.schema.json`           | DM-CATALOG                | `documentVersion`, `schemaVersion`, `catalogRef.version`                                          | v0           |
-| `rule.schema.json`              | RULE-*                    | `documentVersion`, `schemaVersion`                                                                | v0 (AUD-017) |
-| `diagnostic.schema.json`        | Diagnostic (AM-*)         | `schemaVersion`                                                                                   | v0           |
-| `core-error.schema.json`        | CoreError (AM-*)          | `schemaVersion`                                                                                   | v0           |
-| `changeset.schema.json`         | ChangeSet                 | `schemaVersion`, `baseRevision`                                                                   | v0           |
-| `manifest.schema.json`          | DM-MANIFEST               | `documentVersion`, `schemaVersion`, `catalogRef.version`, `targetRef.version`, `producer.version` | v0           |
-| `artifact.schema.json`          | DM-ARTIFACT               | `documentVersion`, `schemaVersion`, `targetRef.version`, `producer.version`                       | v0           |
-| `installation-plan.schema.json` | DM-PLAN (v1)              | `documentVersion`, `schemaVersion`, `protocolVersion`                                             | v0           |
-| `runner-envelope.schema.json`   | DM-SESSION (protocolo v1) | `protocolVersion`, `schemaVersion`                                                                | v0           |
+| Archivo                            | Agregado                       | Ejes de versión                                                                                   | Estado       |
+| ---------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------------- | ------------ |
+| `common.schema.json`               | `$defs` compartidos            | —                                                                                                 | v0           |
+| `draft.schema.json`                | DM-DRAFT                       | `documentVersion`, `schemaVersion`, `revision`, `catalogRef.version`, `targetRef.version`         | v0           |
+| `catalog.schema.json`              | DM-CATALOG                     | `documentVersion`, `schemaVersion`, `catalogRef.version`                                          | v0           |
+| `rule.schema.json`                 | RULE-*                         | `documentVersion`, `schemaVersion`                                                                | v0 (AUD-017) |
+| `diagnostic.schema.json`           | Diagnostic (AM-*)              | `schemaVersion`                                                                                   | v0           |
+| `core-error.schema.json`           | CoreError (AM-*)               | `schemaVersion`                                                                                   | v0           |
+| `changeset.schema.json`            | ChangeSet                      | `schemaVersion`, `baseRevision`                                                                   | v0           |
+| `manifest.schema.json`             | DM-MANIFEST                    | `documentVersion`, `schemaVersion`, `catalogRef.version`, `targetRef.version`, `producer.version` | v0           |
+| `artifact.schema.json`             | DM-ARTIFACT                    | `documentVersion`, `schemaVersion`, `targetRef.version`, `producer.version`                       | v0           |
+| `installation-plan.schema.json`    | DM-PLAN (v1)                   | `documentVersion`, `schemaVersion`, `protocolVersion`                                             | v0           |
+| `runner-envelope.schema.json`      | DM-SESSION (protocolo v1)      | `protocolVersion`, `schemaVersion`                                                                | v0           |
+| `application-contract.schema.json` | Contrato aplicación (ADR-0011) | `documentVersion`, `schemaVersion`                                                                | v0           |
+| `clause-base.schema.json`          | CLAUSE-BASE-001                | —                                                                                                 | v0           |
+| `clause-manifest.schema.json`      | CLAUSE-MANIFEST-001            | —                                                                                                 | v0           |
+| `clause-option.schema.json`        | CLAUSE-OPTION-001              | —                                                                                                 | v0           |
+| `clause-rule.schema.json`          | CLAUSE-RULE-001                | —                                                                                                 | v0           |
+| `clause-bytes.schema.json`         | CLAUSE-BYTES-001               | —                                                                                                 | v0           |
+| `clause-host.schema.json`          | CLAUSE-HOST-001                | —                                                                                                 | v0           |
+| `clause-boot.schema.json`          | CLAUSE-BOOT-001                | —                                                                                                 | v0           |
 
 Los ejes son independientes (ADR-0006). Formato congelado en MVP-1: `documentVersion` =
 `vNext`/`vNext.N`; `schemaVersion` y `protocolVersion` = entero positivo; `catalogRef` /

contracts/json-schema/application-contract.schema.json

@@ -0,0 +1,122 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://archmaker.dev/schemas/application-contract.schema.json",
+  "title": "ArchMaker Application Contract (ADR-0011)",
+  "description": "Contract produced from a resolved configurator selection, an Arch Linux x86_64 base identity and an admitted export format (DEC-001). Each clause is verified independently. Does not admit an image target. Contract state: v0.",
+  "$comment": "ADR-0011. additionalProperties:false. Format enum matches artifact.targetRef.id (DEC-001). Image format is not admitted; CLAUSE-BOOT-001 cannot be satisfied yet.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "documentVersion",
+    "schemaVersion",
+    "contractId",
+    "manifestDigest",
+    "base",
+    "format",
+    "clauses"
+  ],
+  "properties": {
+    "documentVersion": {
+      "$ref": "https://archmaker.dev/schemas/common.schema.json#/$defs/documentVersion"
+    },
+    "schemaVersion": {
+      "$ref": "https://archmaker.dev/schemas/common.schema.json#/$defs/schemaVersion"
+    },
+    "contractId": {
+      "description": "Stable identity of this contract instance.",
+      "$ref": "https://archmaker.dev/schemas/common.schema.json#/$defs/uuid"
+    },
+    "manifestDigest": {
+      "description": "Semantic digest of the sealed manifest that all formats project.",
+      "$ref": "https://archmaker.dev/schemas/common.schema.json#/$defs/contentDigest"
+    },
+    "base": {
+      "description": "Cited Arch Linux base ISO identity (DEC-008).",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["distro", "arch", "kind"],
+      "properties": {
+        "distro": {
+          "type": "string",
+          "const": "arch-linux"
+        },
+        "arch": {
+          "type": "string",
+          "const": "x86_64"
+        },
+        "kind": {
+          "type": "string",
+          "const": "base-iso"
+        }
+      }
+    },
+    "format": {
+      "description": "Admitted export format (DEC-001). Image is not admitted.",
+      "type": "string",
+      "enum": ["archmaker-profile", "archinstall-profile", "report"]
+    },
+    "clauses": {
+      "description": "Closed list of seven clauses. Order is fixed.",
+      "type": "array",
+      "minItems": 7,
+      "maxItems": 7,
+      "items": {
+        "$ref": "#/$defs/clauseEntry"
+      }
+    },
+    "packageNames": {
+      "description": "Package names projected from loaded options for the admitted format. No cmd, no pacstrap.",
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 128,
+        "pattern": "^[a-z0-9][a-z0-9+._-]*$"
+      },
+      "uniqueItems": true
+    },
+    "publicName": {
+      "description": "Visible artifact name. Must not start with ARCH while ADR-0010 is proposed (NFR-MARK-001).",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^(?![Aa][Rr][Cc][Hh]).+$"
+    }
+  },
+  "$defs": {
+    "clauseId": {
+      "description": "Closed vocabulary of application-contract clauses (ADR-0011).",
+      "type": "string",
+      "enum": [
+        "CLAUSE-BASE-001",
+        "CLAUSE-MANIFEST-001",
+        "CLAUSE-OPTION-001",
+        "CLAUSE-RULE-001",
+        "CLAUSE-BYTES-001",
+        "CLAUSE-HOST-001",
+        "CLAUSE-BOOT-001"
+      ]
+    },
+    "clauseStatus": {
+      "description": "Verification status of a clause. satisfied is forbidden for CLAUSE-BOOT-001 until an image format is admitted.",
+      "type": "string",
+      "enum": ["pending", "satisfied", "failed", "not-applicable"]
+    },
+    "clauseEntry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "required", "status"],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/clauseId"
+        },
+        "required": {
+          "type": "boolean"
+        },
+        "status": {
+          "$ref": "#/$defs/clauseStatus"
+        }
+      }
+    }
+  }
+}

contracts/json-schema/clause-base.schema.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://archmaker.dev/schemas/clause-base.schema.json",
+  "title": "CLAUSE-BASE-001 — Arch base and derived mark",
+  "description": "The cited base is Arch Linux x86_64. The published artifact is a derivative: it may say derived from Arch Linux and must not present itself as official Arch Linux, use the Arch logo, or publish a visible name starting with ARCH while ADR-0010 is proposed.",
+  "$comment": "ADR-0011 / CLAUSE-BASE-001. Normative schema; tracking issue kind:clause.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id",
+    "base",
+    "presentsAsOfficialArch",
+    "usesArchLogo",
+    "publicName"
+  ],
+  "properties": {
+    "id": {
+      "type": "string",
+      "const": "CLAUSE-BASE-001"
+    },
+    "base": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["distro", "arch", "kind"],
+      "properties": {
+        "distro": { "type": "string", "const": "arch-linux" },
+        "arch": { "type": "string", "const": "x86_64" },
+        "kind": { "type": "string", "const": "base-iso" }
+      }
+    },
+    "presentsAsOfficialArch": {
+      "type": "boolean",
+      "const": false
+    },
+    "usesArchLogo": {
+      "type": "boolean",
+      "const": false
+    },
+    "publicName": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128,
+      "pattern": "^(?![Aa][Rr][Cc][Hh]).+$"
+    },
+    "derivedFromStatement": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256
+    }
+  }
+}

contracts/json-schema/clause-boot.schema.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://archmaker.dev/schemas/clause-boot.schema.json",
+  "title": "CLAUSE-BOOT-001 — Derived image boot (not yet admitted)",
+  "description": "UEFI x86_64 boot of the derived image. Until an image format is admitted by scope and DEC-001, status must not be satisfied. aarch64 is rejected.",
+  "$comment": "ADR-0011 / CLAUSE-BOOT-001. Satisfied is excluded from the status enum while image format is closed.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["id", "status", "arch", "firmware"],
+  "properties": {
+    "id": {
+      "type": "string",
+      "const": "CLAUSE-BOOT-001"
+    },
+    "status": {
+      "description": "Cannot be satisfied until image format is admitted.",
+      "type": "string",
+      "enum": ["pending", "failed", "not-applicable"]
+    },
+    "arch": {
+      "type": "string",
+      "const": "x86_64"
+    },
+    "firmware": {
+      "type": "string",
+      "const": "uefi"
+    },
+    "imageFormatAdmitted": {
+      "type": "boolean",
+      "const": false
+    }
+  }
+}